Database
WordPress Vulnerability Database (page 1295)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Privilege Escalation | CVE-2019-10270 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15660 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-15116 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-5974 | — | |
| High8.8 | Arbitrary File Upload | CVE-2019-15649 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-5972 | — | |
| High8.8 | Cross-site Request Forgery | CVE-2019-5971 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-5973 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2019-5970 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-15864 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15865 | — | |
| High7.5 | Unauthorized Account Creation | CVE-2019-15863 | — | |
| High8.8 | Arbitrary File Upload | CVE-2019-15866 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-5963 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-5962 | — | |
| Critical9.8 | Unprotected Functions | CVE-2019-12498 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15645 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2019-12566 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-15644 | — | |
| High8.8 | Privilege Escalation | CVE-2019-15867 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2019-12346 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2019-15868 | — | |
| High8.8 | Cross-site Request Forgery | CVE-2019-5980 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2019-12345 | — | |
| High7.8 | Unauthenticated CSV Injection | CVE-2019-11872 | — | |
| High7.5 | Arbitrary File Download | CVE-2022-1119 | — | |
| Critical9.8 | Cross-Site Request Forgery | CVE-2019-12239 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting from Visitors | CVE-2019-15112 | — | |
| Medium5.3 | Sensitive Information Exposure | CVE-2019-14800 | — | |
| Critical9.8 | SQL Injection | CVE-2019-14801 | — |
- High8.8Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Cross-Site Request Forgery
WP-Members Membership Plugin
≤3.2.7Update to 3.2.8.1
- Medium6.1Stored Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.9.16Update to 2.9.16
- High8.8Cross-Site Request Forgery
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤10.4.4Update to 10.4.5
- High8.8Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
<4.2999Update to 4.2999
- Medium6.1Cross-Site Scripting
Online Lesson Booking
≤0.8.6Update to 0.8.7
- High8.8Cross-site Request Forgery
Attendance Manager
≤0.5.6Update to 0.5.7
- High8.8Cross-Site Request Forgery
Online Lesson Booking
≤0.8.6Update to 0.8.7
- Medium6.1Stored Cross-Site Scripting
Attendance Manager
≤0.5.6Update to 0.5.7
- Medium6.1Cross-Site Scripting
Breadcrumbs by menu
<1.0.3Update to 1.0.3
- High8.8Cross-Site Request Forgery
Breadcrumbs by menu
≤1.0.1Update to 1.0.3
- High7.5Unauthorized Account Creation
ConvertPlus
≤3.4.4Update to 3.4.5
- High8.8Arbitrary File Upload
Crelly Slider
≤1.3.4Update to 1.3.5
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- Medium6.1Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- Critical9.8Unprotected Functions
3CX Free Live Chat, Calls & Messaging
<8.0.33Update to 8.0.33
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- Medium6.4Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.5Update to 12.6.6.1
- High7.2Stored Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- High8.8Privilege Escalation
Slick Popup: Contact Form 7 Popup Plugin
<1.7.2Update to 1.7.2
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
<4.8.73Update to 4.8.73
- High8.8Cross-Site Request Forgery
Affiliates Manager
<2.6.6Update to 2.6.6
- High8.8Cross-site Request Forgery
Related YouTube Videos
<1.9.9Update to 1.9.9
- High7.2Stored Cross-Site Scripting
Hostel
≤1.1.3Update to 1.1.4
- High7.8Unauthenticated CSV Injection
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤6.0.7Update to 6.0.8.1
- High7.5Arbitrary File Download
Simple File List
≤3.2.7Update to 3.2.8
- Critical9.8Cross-Site Request Forgery
WP Booking System – Booking Calendar
<1.5.2Update to 1.5.2
- Medium6.1Unauthenticated Stored Cross-Site Scripting from Visitors
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤4.8Update to 4.8.1
- Medium5.3Sensitive Information Exposure
FV Flowplayer Video Player
≤7.3.14.727Update to 7.3.15.727
- Critical9.8SQL Injection
FV Flowplayer Video Player
<7.3.15.727Update to 7.3.15.727